# Portal requirements

Regex Tools is a static nested-path-safe application.

Required delivery behavior:

- JavaScript workers use a JavaScript MIME type.
- `toolbox-app.json`, HTML and legal/source documents should remain
  revalidation/no-cache resources.
- Hashed Vite assets may use immutable long-term caching.
- CSP must allow `worker-src 'self' blob:`.
- `engines/pcre2/pcre2.wasm` must use `application/wasm`.
- `script-src` must permit self-hosted WebAssembly compilation, normally with
  `'wasm-unsafe-eval'`; broad `'unsafe-eval'` is neither needed nor recommended.
- `engines/pcre2/pcre2.mjs`, metadata, checksums, licence and WASM should use
  revalidation or a release-scoped immutable cache. They are not
  content-hashed filenames and must never drift under one release identity.

The Portal must consume the immutable release ZIP, verify its SHA-256, verify
manifest ID `de.add-ideas.regex-tools` and version `0.2.0`, and mount it at a
relative target such as `apps/regex/`.

The package, manifest, tag, artifact URL and checksum must all use the v0.2.0
identity. The historical v0.1.0 artifact coordinates remain immutable and must
not be overwritten or reused.